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Abstract 

Aiming at a ternary quantum logic circuit, four symmetric ternary quantum ho¬ 
momorphic encryption schemes, based on ternary quantum one-time protocol, were 
presented. First, for a one-qutrit rotation gate, a homomorphic quantum encryption 
scheme was constructed. Second, in view of the synthesis of a general 3x3 unitary 
transformation, another one-qutrit quantum homomorphic encryption scheme was pro¬ 
posed. Third, according to the one-qutrit scheme, the two-qutrit quantum homomorphic 
encryption scheme about GCX(m’)gate was constructed and was further generalized to 
the n-qutrit unitary matrix case. Finally, the security of these schemes was analyzed 
from two perspectives. It could be concluded that the attacker can correctly guess the 
encryption key with a maximum probability pk = l/3 3n , thus it can better protect 
the privacy of users data. Moreover these schemes can be well integrated into future 
quantum remote server architecture, and the computational security of the users private 
quantum information can be well solved in a distributed computing environment. 


1 Introduction 

In a distributed computing environment, customers have a large amount of data stored 
in the remote server. These data may include personal bank account information, online 
shopping records, credit card consumption records, etc., and this information belongs to 
customers private encrypted data which is indistinguishable for a remote server. Suppose 
we intend to compute on the encrypted data without a decryption process, or delegate it 
to a trusted third party without leaking information of the input data: is it possible to do 
so? Fortunately, blind computation]]!] or homomorphic encryption]^ [3i 0., 5] can achieve 
it perfectly without a decryption process and leaking private information of the encrypted 
input data. 

From the perspective of quantum information processing, performing operations on en¬ 
crypted data without a decryption process is relative to blind quantum computation!!)], 0 
0Elia Ujand quantum homomorphic encryption (QHE). This paper will study this prob¬ 
lem by the QHE technique that can not only protect the privacy of users data, but also 
accomplish secure computation! on a remote server. 

Rohde et al.[T2j firstly studied quantum walks with encrypted data, and then they 
proposed a limited QHE scheme using the Boson sampling and multi-walker quantum walk 
models on Linear Optics Quantum Computation. However, QHE has still not been defined, 
and a quantum fully homomorphic encryption (QFHE) scheme has not yet been constructed. 

Liang |T3li firstly presented the definitions of the QHE and QFHE, and then, based on 
the Quantum One-Time Pad (QOTP) protocol, he constructed the symmetric QHE and 
QFHE scheme with perfect security, where evaluation function depends on the encryption 
keys. Subsequently, learning from the Universal Quantum Circuit (UQC), he proposed a 
QFHE scheme [H] . In the scheme, the encryption key is different from the decryption key, 
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and cannot be public. Moreover, evaluation algorithm is independent of the encryption key, 
and the decryption key can be computed from the encryption key by an interactive update 
process. Recently, Liang[T5] again presented two QFHE schemes, which are constructed 
based on quantum fault-tolerant construction. The characteristics are using quantum CSS 
code as the secret key and containing the periodical interaction between Client and Server. 

Armknecht et al. m proved the general impossibility of (Abelian) group homomorphic 
encryption in the presence of quantum adversaries, when assuming the IND-CPA security 
notion as the minimal security requirement. And they provided a sufficient condition and 
discussed its satisfiability in non-group homomorphic cases. Tan et al. m presented a 
private-key QHE scheme that hides arbitrary quantum computations. A particular instance 
of their encoding hides information at least proportional to mlogm bits when m bits are 
encrypted. Recently, Broadbent et al. [18j presented QHE schemes for circuits of low T- 
gate complexity. These schemes allow for arbitrary Clifford group gates, but they become 
inefficient for circuits with a large degree of complexity, measured in terms of the non-Clifford 
portion of the circuit. 

Currently, QHE research is limited and mainly focused on the quantum bits (qubits). 
According to present research, this article presented four Ternary QHE (TQHE) schemes 
based on the Ternary QOTP (TQOTP) for the first time. The rest of the paper is organized 
as follows. Section 2 provides a brief introduction to ternary quantum gates and QHE, and 
a TQOTP scheme is presented. In section 3, the first TQHE scheme, based on one-qutrit 
rotation gatesi?^^#), is constructed, and it is generalized to a general ternary quantum 
gate with synthesis idea. Then the third TQHE scheme about a GCX gate is constructed, 
and extended to n-qutrit gate in theory. These schemes are analyzed by synthesizing con¬ 
cepts from ternary quantum gates, secret key security and user data privacy in section 4. 
Conclusions and future research ideas are presented in section 5. 

2 Preliminaries 

2.1 Universal Quantum Circuits 

Definition 1 . (Universal Quantum Circuit (UQC)[19]) Fix n > 0 and let C be a collection 
of quantum circuits on n qubits. A quantum circuit JJ on (n + m) qubits is universal for 
C if, for every circuit Cjj £ C, there is a string x £ {0, l} m (the encoding) such that, for all 
strings ,y £ {0, l} n (the data), 


U(\y)®\x)) = Cu(\y))®\x) (2.1) 

The definition of the UQC tells us two things: one is that an arbitrary U transformation 
can be synthesized by a finite number of logic gates of the C set. Another is that blind 
quantum computation or homomorphic encryption scheme can be constructed, which will 
be discussed later. In the UQC, given a n-qubit | y) as the input data, while a m-qubit 
|x) is input as the encoding of a quantum transformation Cjj G C , the UQC would output 
(n + m) qubits (shown in Eq |2.1[ ). Here,n-qubit |:r) is called the encoding of the quantum 
transformation Cjj G C with regard to the UQC C. |x) as input data can not only hide 
the data | y) but also protect the operation Cjj. Furthermore, Eq ]2.1| gives a transformation 
between U and Cjj quantum circuit, which means it is possible to construct a homomorphism 
operator between U and Cjj- 

2.2 Ternary Quantum Circuit 

A qutrit is represented as a unit vector in state space, which is a complex three-dimensional 
vector space H%. In the computational basis, the basis vectors (or basis states) of H 3 are 
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written in Dirac notation as |0),|1), and 1 2) , where |0) = (1,0,0) T , |1) = (0,1,0) T , and 
12) = (0,0, 1) T . An arbitrary vector | cp) in H 3 can be expressed as a linear combination 
| ip) = ao |0) + a\ |1) + 02 12), where a, G C and 0 l a *| 2 = T The real number | a* | 2 is the 
probability that the state vector will be in the ith basis state upon measurement. 

A qudit is represented as a unit vector in the state space, which is a complex projective 
d dimensional Hilbert space Hj. In the computational basis, the basis vectors of are 
written in Dirac notation as |0) , |1), • • •, \d — 1), where \i) =(0,0,..., 1, ...,0) T with a 1 in 
the (i+l)st coordinate, for 0 < i < d — 1. Its linear combination is similar with that of 
the qutrit. Note that the basis vectors in the computational basis are ordered by natural 
numbers. 


2.2.1 Common one-qutrit circuits 

l)Ternary X ^' 3 ' 1 (TX) gates 

The operators X ^ 13 ' 1 are defined as follows, 


= I*) 01 +1 3 ) (*l + 5^1=4- • ^ G {M,2} 


( 2 . 2 ) 


( \j), k = i 

The I™) gates acting on \k) can be represented as X^ \k) = < \i), k = j . Because 

[ | k),others 

X^' 3 ) = and X^ 3 \ = j = I 3 ,TX gates have three valid forms and are defined as follows: 


x ( 0 ) = x (01) ,X (1 ) = X (02) , and X (2) = A (12 ) 

2)Ternary H^ l3 '> gates 

The ternary extension of Hadamard gate can be expressed as 
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(2.3) 


(2.4) 


The gates acting on | k) can be expressed as 


f/\/2(| i) + | j)),k = i 
H^\k) = { l/V2(\i)-\j)),k = j 
I k), k^i,j 


(2.5) 


3)Ternary Z W gates 

The Z^> gates can be denoted as follows, 

Z (0) = diag{-l,I 2 j,Z (1) = diag{l, -1,1}, Z (2) = diag{I 2 ,~ 1} (2.6) 


The Z %3 gates applied to | k) can be expressed as ZW \ k) 


— | k) ,i = k 
\k), i^k 


4) Ternary shift gates 

The ternary shift gates are listed in Table 1, in which the addition is mode 3 addition. 

5) Ternary rotation gates 

The definition of a one-qutrit rotation gate is listed in Eq|2.7| 


Rf\0) = exp(-iaf : >0/2) 


(2.7) 
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Table 1: Ternary shift gates. 


Name 

Operation 

Equivalent to X operations 

Buffer 

f{x) = X 

h 

Single-shift 

f{x) =x + l 

X 01 X 12 

Dual-shift 

fix) =x + 2 

x 12 x 01 

Self-shift 

fix) = 2x 

X 12 

Self-Single-shift 

fix) = 2x + 1 

X 01 

Self-Dual-shift 

fix) = 2x + 2 

X 02 


where d € {x,y,z}, 0 < i < j < 2 , a= \i) (j\ + \j) {i\, a£ J> = -i\i) (j\ + i\j) (i\, 
Gz ' J ' > = | i) (*| — | j) (j\. Based on exponent mapping[20]. the following four equations are 


(ij) 


obvious, R^iO) = 


R ( z >1 \0) = 


cos( 0 / 2 ) 

sin( 0 / 2 ) 
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— sin( 0 / 2 ) 
cos( 0 / 2 ) 
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,RT\ 6 ) = 


cos( 0 / 2 ) 
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sin( 0 / 2 ) 


-sin( 0 / 2 ) 

0 

cos( 0 / 2 ) 


( e ~ ie / 2 

0 

0 \ 

/ e ie / 2 

0 

0 \ 

( 0 

e ie /2 

0 and Rz id) = 

° 

1 

0 1 

V 0 

0 

1 / 

V 0 

0 

e-ie/2 j 


A one-qutrit gate is essentially a 3 x 3 unitary matrix. According to the Cartan Decom¬ 
position of Lie algebra, the unitary matrix U has the following form [[21]. 


U x = e ia Ri m \p)Ri 02 \^)R^ 1 \8)R { ° 1 \e), 

U 2 = r£ 2 \v)r£ 1 \P')R$ 2 \'i')R$ 1 \8'), ( 2 - 8 ) 

U = Th x U 2 . 


where a, f3 , 7 , <5, 9, ip, (3', ^ and 5' are all real numbers. The four basic one-qutrit rotation 
gates, R^ 1 \fi), R^y 2 \^), R^z l \o), and R^ 2 \ip), constitute a set of one-qutrit elementary 
gates [ 20 ], 


2.2.2 Common two-qutrit circuits 

1) Ternary NOT gate 

A Ternary NOT gate Nj(Ai) is defined as Pj = Aj® 3 1, if j = i; else Pj = Ai, where ©3 
stands for addition modulo 3. 

2) Feynman gate 

It is defined as TFa,b(A, B) = {A,A@$B), where ©3 stands for addition modulo 3, and 
A, 5 G{0,1,2}. 

3) Ternary A-Controlled X (TKCX) Gate 

For a TKCXi lj i 2 ... j i k -j(B) gate, when Bn = Bi 2 = ■ ■ ■ = Bik = 2, X^R will be acted on 
target bit Bj, therein Bn,Bi 2 ,- ■ -,Bjk are control bits. When K= 1, the TKCX gate will 
evolve into the TCX gate. 

4) Ternary A-Controlled-NOT (TKCNOT) gate 

A TKCNOT gate Ci 1> i 2j ... j i k -j(Ai) is defined as follows 

• if j ^ l, then P t = C iliia) ... t i h . tj (A l ) = A t . 

• ? '/ j = h an d Aa = Ai 2 = • • • = Ai k = 2 , then Pj = Aj© 3 l; else Pj = Aj. 

5) Generalized Controlled X(GCX) Gate 

For a GCX(m / ) gate and a two-qutrit | m,A), When m' is fixed as a special control bit 
and m' = m, X^A will be acted on target bit A; Otherwise GCX(m / ) gate will not affect 
the state |m, A),for m',m € {0,1,2}. 
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2.3 TQOTP scheme 

By referring to QOTP[22j and combining it with ternary quantum information technology, 
we design a TQOTP scheme. Suppose an n-qutrit encryption operator is denoted as 

U k £ {X a H f3 Z s \a, /3, 5 £ {0,1, 2}"} (2.10) 

Where X, H, and Z all represent ternary quantum gates, and X a = H 13 = 

(8> 2=iH^\ Z s = ®™ = 1 Z^( l \ Obviously, we can use 3 n random natural numbers and patulous 
bit-wise XHZ gates to encrypt an n-qutrit quantum state. The encryption operator U k 
satisfies a uniform distribution of 3 3n unitary matrices. Thus, the probability p k , which 
means the probability of choosing U k , is defined as p k = l/3 3n . Actually U k is a 3 n x 3 n 
unitary matrix. The encryption procedure is | ijj c ) = U k \<p) = X a H l 3 Z s and the 

decryption procedure is |i Jj m ) = U\ \ipc) = U\x a H' 3 Z 5 \tpm) = Z 5 H 3 X a X a H 3 Z 5 \tp m ) = 

| ¥hra) • 

Remark 1. With respect to our TQOTP scheme, there are some improvements which 
we can do. These improvements include determining how to combine the TQOTP scheme 
with quantum key distribution, and construct the encryption operator U k , and so on. By 
improving the TQOTP scheme, we can obtain an information-theoretically-secure scheme. 
These interesting problems will be discussed in future work. 

2.4 QHE scheme 

Definition 2. A QHE scheme is composed of four algorithms113]: a key generation algo¬ 
rithm, an encryption algorithm, a decryption algorithm and an evaluation algorithm. 

Compared with the usual quantum encryption scheme, the QHE scheme has a fourth 
evaluation algorithm, which is used to process the quantum ciphertext without decrypting 
it. The purpose of the evaluation algorithm is mainly to construct a homomorphic unitary 
operation, which can be acted on given quantum ciphertext, according to a given unitary 
operation. After a user has decrypted the result of the evaluation algorithm, he will obtain 
the same result of the corresponding operation in plaintext. So how to construct a homo¬ 
morphism operation on given quantum ciphertext is the key issue in constructing the QHE 
scheme. 

Remark 2. Suppose p c and a rn are the forms of density matrices for quantum states. Ta 
is a set of permitted quantum operators. The evaluation algorithm can be described as 
follows: according to the key and the given operator T G Ta, it generates another quantum 
operator T’ and performs it on the ciphertext p c . In this case, the operator T’ is related to 
the operator T and the key. The operator T can be regarded as a desired operation on the 
plaintext a m . The operation T’ corresponding to T is performed on the ciphertext p c , and 
can implement the desired operation on the plaintext a m . 

3 TQHE scheme 

3.1 One-qutrit TQHE scheme 

l)One-qutrit rotation gates 

For a set of permitted quantum operators ^Rq 3 \o )|<9 £ {y, z} ,ij G {01,02} j, we only 

consider four forms, , B^ 2 \9), R^ l \o) and R^ 2 \d), in the first TQHE scheme. 

The evaluation algorithm will construct the corresponding homomorphic operator 
such that 

^ j) X a H^Z 5 = X a H^Z 5 Rf\0) (3.1) 


5 


It is deduced that = X a Z s R^\o)Z s X a . The first TQHE scheme is shown as 
follows. 

K eyGenAlgorithnv.R&ndomly generate three key numbers a, (3,5 E {0,1, 2}; 

Encrypt Algorithm : p c = X a H^ Z 6 cr m Z s H 13 X a \ 

DecryptAlgorithm : a m = Z s X a p c X a H^ Z s \ 

EvaluateAlgorithm: According to a, (3,5 and Rg 2 \d), it performs homomorphic oper¬ 
ator = X a H^Z s Rf\e)Z 5 H^X a on the given ciphertext p c without a decryption 

process. The output state of EvaluateAlgorithm is 


= X a H^Z\Rf\e)a m (Rf\e))^)Z s H^X a (3.2) 

For Eq |3.2| a brief verification is given as follows, 

= X a H^Z 5 R^ j \9)Z s H^X a X a H^Z 5 a m Z s H^X a (^ j) ^ 

= X a Hf i Z 5 Rf ) (e)a rn Z 6 H^X a ^f ) Y 
= X a H^Z 5 Rf\6)a m Z 5 H^X a X a H^Z\Rf\e)^Z 5 H^X a 
= X a H^Z 5 (Rf\d)a m (Rf\e)^Z & H^X a 

So Eq |3.2| holds. After the user decrypts the state of Eq |3.2t he will obtain the desired-state 
as follows 


Z s HPX a ^ j) p c (^ j) yX a HPZ s 

= Z s H^X a X a H^ Z 6 (R^ j \e)a m (R { ^ j) (6))^)Z S H^X a X a H^ Z s (3.4) 

= Rf\e)a m {Rf\e)y 


Obviously, according to Eq ]3.4| the output state of EvaluateAlgorithm is just the result of 
the operator Rg (0) acting on the plaintext a m after the user decrypts it. 

For a instance, suppose the user plaintext state is |0) = (1,0,0) 

0 0-1 

operator on the plaintext is R^ > 1 \tt) = 


the user-desired 



, and the encryption operator 14 is 


X 2 H°Z 1 = 4? 

V z 



Thus the homomorphic operator ^Ry 01 ' 1 is \ 



The output state of EvaluateAlgorithm is Z 1 H°X 2 ^Ry )1 ^X 2 H 0 Z 1 |0) = (0,0, l ) 7 = R^^tt) 10), 
which is exactly the output of the user-desired operator i?y 01 ^( 7 r) acting on the plaintext 
|0). Moreover, no decryption is performed during the computing of EvaluateAlgorithm. 
Thus, the scheme satisfies the definition in section 2.4, and the result of the homomorphism 
operator is precisely the user-desired output state. 

2 )General one-qutrit gates 


An arbitrary 3x3 unitary matrix U can be decomposed into some Rq^ terms (; 


see 


Eq2.8). Accordance to Eq3.1, we can obtain the homomorphism operator dig 2 ' 1 corre¬ 


sponding to Rg^ acting on the quantum plaintext state. Thus the homomorphic operator 

3?c/ corresponding to the unitary matrix U can synthesized by eight 3?^ . Referring to the 
first TQHE scheme, we can propose the second TQHE scheme for an arbitrary 3x3 unitary 
matrix U. It can be seen that the operator is a little complicated. As a result it will 
influence the execution efficiency of EvaluateAlgorithm. 


3.2 TQHE scheme for GCX gate 

The Cartan Decomposition of one-qutrit gate is not unique, so the choice of one-qutrit 
elementary gates is not unique either. Refs.23 and 24 regard GCX gate and extended 
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Figure 1: Synthesis of TSUM gate. 



Figure 2: Synthesis of TSWAP gate. 


rotation gate as a two-qutrit elementary gate, respectively. In this paper, we choose the 
GCX gate as a ternary quantum elementary gate, which is universal for n-qutrit quantum 
computing, when it is assisted by arbitrary one-qutrit gates. The common two-qutrit gates: 
TCX, TSWAP, TSUM (TFeynman), TXOR, and TShift gate can be synthesized by some 
GCX gates without auxiliary one-qutrit gates. For example, the TSUM (TFeynman) gate is 
synthesized by four GCX gates, as shown in Fig{l] Likewise, the TSWAP gate is synthesized 
by nine GCX gates (see Figj2| and the TXOR gate synthesized by three GCX gates (see 
Figj3j). 

When the control bit m' is set to |0) state (or |1) or |2) ) and m! = m, the effect of the 
GCX(m’ ) gate is that the operator will be applied to the target bit A. Namely, 

GCX(m') | m, A) = (I 3 ® X^) \m, A) = \m) ® \A) (3.5) 

If rn' ^ m, then the operator X^ will be equivalent to J 3 without affecting the target 
bit A. Therefore the homomorphism operator of the GCX(m’) gate is exactly the similar 
with the operators X^ £ A^ 02 \ A^ 12 ^} (equivalent to X^ £ X^\ X^ 2 )}). 

In order to better describe the performance of the GCX(m’) gate acting on the two-qutrit 
| m,A), the function of ) is defined as follows 


t = f(m', m ) 


J 3 , m! = m 
X^\m’ / m 


(3.6) 


So the third TQHE scheme associated with the GCX gate is described as follows. 

Key Gen Algorithm: Randomly generate three numbers a, (3,6 £ {0,1,2} 2 ; 

Encrypt Algorithm : p c = X a H^Z s cr m Z s H^X a -, 

DecryptAlgorithm : <j m = Z s H 13 X a p c X a H 8 Z S ] 

EvaluateAlgorithm: According to a, /3, <5, i and j, it computes the homomorphic operator 
= X a H 13 Z s (I 3 < 8 > X^t)Z s H> 3 X a . Then the corresponding operator X^ will be 
acted on the given ciphertext p c without performing DecryptAlgorithm. The output state 
of EvaluateAlgorithm is 

X (ij)Pc X }ij) = X a H^Z 5 ((I 3 ® X^T)a m (h ® X^T)^)Z 6 H^X a (3.7) 



Figure 3: Synthesis of TXOR gate. 
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Obviously it is just the same as the operator J 3 8 > X^’t acting on the plaintext a m . The 
scheme based on the GCX gate satisfies the QHE scheme demand. 

For example, suppose that the user’s plaintext state is 102) = (0, 0,1, 0, 0,0,0,0,0) T . 


For the user-desired GCX(m’), the control bit m , is set to 0 and operator X is speci¬ 
fied as X m r (equivalent to I 3 8> X^ 02 \r = = I 3 ). The encryption operator 


is 

denoted 

as 

e 3 2 x3 2 

= x 12 h 02 z 01 

= C* 1 
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3 0 UT, 

where 

u 

= \[ 

-V 2 
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and r = 

I 3 . The output state is 
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V 2 

1 

1 ) 




Z m H m X 12 X {ij) X 12 H 02 Z m |02) = (1,0,0,0,0,0,0,0,0) T = |00) = (J 3 8> X^t) |02) After 
a user has decrypted the result of EvaluateAlgorithm , he will obtain the same result as the 
user-desired operator X^^t acting on the plaintext a m . The scheme is in accord with the 
definition in section 2.4. 

3.3 n-qutrit TQHE scheme 

Any n-qutrit quantum gate can be expressed as a 3 n X 3 n unitary matrix. Based on one/two- 
qutrit quantum gates, there are plenty of research opportunities for n-qutrit quantum gates 
by using permutation group theory and Cosine-Sine Decomposition (CSD). According to 
permutation group theory, all n-qutrit((n > 2)) quantum circuits can be generated by 
a group of two-qutrit gates: SWAP, NOT and 1-controlled-NOT gates without ancillary 
qutritsf25, J26j. Obviously, it is only a construction-based algorithm. In terms of CSD, a 
3 n X 3 n unitary matrix can be synthesized by 12 controlled- U gates, 12 Dual-Shift gates, 
3 n (A-l)-controlled rotation gates and 2 • (n — 1) • 3 n_1 TX gates{2?j. The (A-l)-controlled 
rotation gate is defined as follows 


(N — l)CR(A\, ■ ■ -A n -, B) = 


For Ai, B E {0,1,2}, R E 



(2ll, • • •; 

1 A n _ ]. 

RB). 

I Ai 

= 2,1 

(Ai, • • • 

j A n — 1 

;B), 



— sin@ 

0 \ 

( 


0 

cos 9 

° 

or 

0 

cos 9 

0 

1 / 

V 

0 

sin 9 


others 


(3.8) 


No matter 


cos ( 


which method is used to synthesize a 3" x 3" unitary matrix, there always exists extremely 
complex process, a giant number gates and very low efficiency. At present, this is a difficulty 
and hot issue of synthesis of multivalue quantum gate. 

According to Ref.25 and section 3.2, we describe a process of how to construct an n- 
qutrit TQHE scheme. TNOT gate and Ternary 1-controlled gate are in fact two single-shift 
gates with conditions (see Ta6/e[l]). The difference is the latter requires the control bit to 
be 2 on base of the formers condition (see Figs j4] and [5]). Obviously, a TNOT gate can 
be synthesized by two GCX gates (see Fig(4]). And a ternary 1-comtrolled gate can be 
synthesized by two conditional GCX gates (see FigjsJ). Therefore, we can conclude that any 
n-qutrit (n > 2) logic circuits can be synthesized by some GCX gates. 
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Figure 4: Synthesis of TNOT gate Cj(A m ). 



Figure 5: Synthesis of Ternary 1-controlled NOT gate Ci 1 -j(A m ). 


Suppose the user will perform the quantum circuit C 3 n x3 n on the given quantum plain¬ 
text. In principle we can get the homomorphism operator C 3 n x 3 „, which is synthesized by 
a large number of GCX gates’ homomorphic operators, such that 

C' 3 n x 3 „X a H / 3 Z 5 = X a H / 3 Z 5 C 3 n x3 n (3.9) 

Where a,/3,6 6 {0, l,2} n . So far we can present n-qutrit QHE scheme in theory. However, 
the form of the operator C 3 n x3 ™ synthesized by a great deal of GCX gates is so complex that 
performing EvaluateAlgorithm is very bad in execution efficiency and energy consumption. 
Thus the n-qutrit QHE scheme does need many improvements in multivalue quantum circuit 
synthesis and homomorphic EvaluateAlgorithm design. 

4 Analysis 

4.1 Circuit synthesis 

Currently, the synthesis of multivalue quantum logic circuit mainly focuses on the simplest 
ternary quantum logic circuits. Although there are some research achievements, they are not 
very mature themselves. How to choose universal ternary quantum gate has not been well 
solved so far. And there are no uniform criteria for the performance analysis, complexity, 
cost, energy consumption, and so on, after the ternary quantum gates being synthesized 
by a number of GCX gates. In short, it is feasible to construct an n-qutrit QHE scheme 
in theorem, but it is too difficult to construct in practice. Therefore, this paper does not 
actually construct such a scheme and we only describe a general construction process by 
the synthesis method. 

In view of the current state of research on the synthesis of an n-qutrit quantum gate 
(actually a 3 n x 3” unitary matrix), synthesis methods of quantum circuit require further 
optimization and refinement. Based on quantum circuit synthesis, construction of an n- 
qutrit QHE scheme is premature. The key reasons are very low performance efficiency and 
difficulties in constructing the homomorphic operator while executing EvaluateAlgorithm. 
Therefore, the TQHE scheme presented in the paper is limited to one-qutrit rotation gates, 
one-qutrit quantum gates and two-qutrit gates synthesized by some GCX gates. Theoreti¬ 
cally, we can generalize the TQHE scheme to the n-qutrit (n > 2) quantum gates case. 

4.2 Security 

Our TQHE schemes, which are based on the TQOTP scheme, all assume that the delegation 
party is honesty. There are two aspects of this representation. One is that it will not leak 
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or snoop users private data in the process of performing Evaluate Algorithm in the case 
of knowing the decryption key. The other is that it will right execute the commissioned 
unitary operators without decryption. The delegation party must know the user-given 
operators and the secret key. Otherwise he cannot correctly construct the homomorphic 
operator. It should be noted that the EvaluateAlgorithm is dependent on the secret key. 
Thus, the delegation party can decrypt it and obtain the original qutrit. This will restrict 
the application of these schemes. Meanwhile these schemes cannot be used in blind quantum 
computation. However, we can delegate the computation to the trusted party by using the 
TQHE schemes, which can prevent the malicious parties from obtaining the data and the 
result of the computation. Of course, these schemes can be also used in secure multiparty 
quantum computation. 

In addition to the legal user and trusted delegation party, there is no party (including 
the eavesdropper, etc.) that is able to get the complete user data. According to our TQOTP 
scheme, which is used to encrypt the users original data, the eavesdropper correctly guesses 
the secret key with the probability pk = l/3 3n . In the case of one-qutrit (n = 1), the 
probability pk is l/3 3n = l/3 3 = 1/27 ~ 3.7% . Similarly, in the case of two-qutrit (n = 2), 
the probability pk is l/3 6 ~ 0.14% and, with three-qutrit (n = 3), the probability pk is 
l/3 9 ~ 5.08 x 10 _3 %. With the increase of original datas length, the secret keys length 
will be longer. So the probability p^ will become smaller and smaller, and eventually it will 
tend to zero. It is extremely difficult for the eavesdropper to correctly guess the secret key. 
Additionally, the quantum key distribution protocols, such as the BB84 protocol, can be 
used to generate and transmit the secret key between user and delegation party, which must 
make our secret key unconditional secure. As a result, our schemes will be more secure. 

The eavesdropper cannot obtain effective and complete information for the user en¬ 
crypted data and the output state of the EvaluateAlgorithm. Suppose forcing to measure 
the intercepted data, the eavesdropper will obtain the random information about these 
encrypted data. Due to the quantum No-Cloning Theorem and Heisenberg Uncertainty 
Principle, along with the TQOTP scheme, the eavesdropper knows nothing about the mu¬ 
tual information of the unknown cipher states, namely I(p c : Eve) ~ 0. There is only 
one round of information exchange between the user and the delegation party in our TQHE 
schemes, rather than several rounds of information exchange in blind quantum computation. 
The benefits of our schemes are the high level of users data privacy and the reduction of 
the times for which sensitive data is exposed. By performing EvaluateAlgorithm, the dele¬ 
gation party will execute the corresponding homomorphic operator in the user-given cipher 
states. The homomorphic operator is equivalent to a new encryption operator, which acts 
on the user-given ciphertext. The homomorphic operator is only known by the delegation 
party, and the eavesdropper knows nothing about it. Without knowing the secret key and 
homomorphic operator, the eavesdropper does not know the secondary encrypted quantum 
states, i.e.,I(p c : Eve) ~ 0. 

The binary QHE schemes presented in Ref. 13 are efficient and perfectly secure, i.e., 
I{p c : a m ) = H(p c ) — H(p c \a m ) = 0. It shows that the ciphertext is independent of the 
plaintext. However, a deterministic QHFE scheme necessarily incurs exponential overhead 
if perfect security is required|28j. This is very difficult to implement in practice. The TQHE 
schemes in this paper are not perfectly secure because of the encryption operator Uk, which 
is not a complete orthogonal basis in n-qutrit Hilbert Space. As a result, both of the output 
quantum states of the EvaluateAlgorithm and EncryptionAlgorithm are not the totally 
mixed states. According to definition 1 in Ref. 11, our TQHE schemes are all e-security. 
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5 Conclusion 


At present, there exist few researches in QHE. According to present research, it is the very 
first time to present these TQHE schemes based on TQOTP in this paper. First, we pro¬ 
posed a TQOTP protocol and these TQHE schemes are based on it. Second, in allusion 
to the ternary quantum rotation gate Rq, we had constructed the homomorphic operator 
and the first TQHE scheme. Then according to general one-qutrit gate synthesized by 

eight gates, we presented the second TQHE scheme. Third, on the basis of Ref.23 and 
the GCX(m’) gate which can be as a two-qutrit universal gate, we constructed the third 
TQHE scheme for the GCX(m’) gate. Referring to Refs.25-26 and the third TQHE scheme, 
we generalized to n-qutrit case and theoretically presented the fourth TQHE scheme. Fi¬ 
nally, we discussed two components of these schemes security. One is that there exists an 
extremely low probability that the attacker correctly guesses the secret key. Another is 
that the attacker knows almost nothing about two kinds of cipher quantum states, i.e., the 
output encrypted quantum states of the Evaluate Algorithm and Encryption Algorithm. 
Meanwhile, future research ideas are to find a TQOTP scheme with perfect security and 
to construct an asymmetric TQHE scheme, where the EvaluateAlgorithm only depends 
on the public key but not the private key. The latter is an open problem. Maybe one can 
consider how to modify the quantum public-key encryption scheme in Refs.29-30, such that 
it becomes an asymmetric QHE scheme. If this goal were achieved, the computing on the 
quantum cipher state could be securely outsourced, and then blind quantum computation 
would be implemented in this way. 
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